CVE-2009-2698: canonical ubuntu_linux NULL Pointer Dereference

Modified

Published 27-08-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-2698 is a high (CVSS 7.8) NULL Pointer Dereference vulnerability in canonical ubuntu_linux. EPSS estimates a 7.12% chance of exploitation in the next 30 days, higher than 94.2% of scored vulnerabilities. 4 public exploits are recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 02-09-2009)

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v3.1 (NVD)

EPSS score

7.12%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits4reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 6

DSA-1872-1 RHSA-2009:1222 RHSA-2009:1223 RHSA-2009:1233 RHSA-2009:1457 RHSA-2009:1469

Timeline

27-08-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.

CVSS metrics

2 scores · 1 source · 2 versions

v3.17.8v2.07.2

EPSS trend

Probability

7.12%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

No change 0.00 pp

From 7.12% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

4 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databaselocallinuxVerified
Linux Kernel < 2.6.19 (Debian 4) - 'udp_sendmsg' Local Privilege Escalation (3)
Maturity: weaponized
exploit-databaselocallinuxVerified
Linux Kernel < 2.6.19 (x86/x64) - 'udp_sendmsg' Local Privilege Escalation (2)
Maturity: weaponized

Show all 4 exploits

exploit-databaselocallinux_x86Verified
Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6 x86) - 'ip_append_data()' Ring0 Privilege Escalation (1)
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat5 products

Suse2 products

linux_enterprise_desktop10:sp2
linux_enterprise_server9 | 10:sp2

Vmware2 products

esxi4.0
vcenter_serverEOL4.0

Canonical1 product

ubuntu_linuxEOL6.06 | 8.04 | 8.10 | 9.04

Fedoraproject1 product

fedoraEOL10

Linux1 product

linux_kernel< 2.6.19

6 vendors · 12 products

References

26 links

www.redhat.com/support/errata/RHSA-2009-1233.htmlVendor AdvisoryX Refsource REDHATBroken LinkThird Party Advisory
rhn.redhat.com/errata/RHSA-2009-1223.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.securityfocus.com/archive/1/512019/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
secunia.com/advisories/37298Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.securitytracker.com/id?1022761VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
secunia.com/advisories/36430Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
lists.opensuse.org/opensuse-security-announce/2009-08/msg00008.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11514VDB EntrySignatureX Refsource OVALBroken LinkThird Party Advisory
secunia.com/advisories/36510Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
secunia.com/advisories/37471Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory

Show all 26 references

rhn.redhat.com/errata/RHSA-2009-1222.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.ubuntu.com/usn/USN-852-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
secunia.com/advisories/23073Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.vmware.com/security/advisories/VMSA-2009-0016.htmlX Refsource CONFIRMThird Party Advisory
www.securityfocus.com/bid/36108VDB EntryX Refsource BIDBroken LinkExploitPatchThird Party Advisory
www.openwall.com/lists/oss-security/2009/08/25/1Mailing ListX Refsource MLIST
www.mandriva.com/security/advisories?name=MDVSA-2011:051Vendor AdvisoryX Refsource MANDRIVABroken LinkThird Party Advisory
www.securityfocus.com/archive/1/507985/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
support.avaya.com/css/P8/documents/100067254X Refsource CONFIRMThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9142VDB EntrySignatureX Refsource OVALBroken LinkThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8557VDB EntrySignatureX Refsource OVALBroken LinkThird Party Advisory
git.kernel.orgX Refsource CONFIRMBroken Link
www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.19X Refsource CONFIRMBroken LinkVendor Advisory
www.vupen.com/english/advisories/2009/3316VDB EntryX Refsource VUPENPermissions Required
secunia.com/advisories/37105Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
bugzilla.redhat.com/show_bug.cgi?id=518034X Refsource CONFIRMIssue TrackingThird Party Advisory